Corporate criminal liability is changing fast — what you need to know

Why this matters now

Major reforms to how prosecutors attribute criminal liability to companies took effect on 26 December 2023 under the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023). Those changes already make it easier to prosecute corporates for a defined set of “economic crimes”.

Now, a further step is moving through Parliament in the Crime and Policing Bill, which would broaden this new attribution rule to cover all criminal offences, not just economic crime. Senior executives and compliance teams should take stock now.

The old rule: the “directing mind and will” test

Historically, the UK relied on the common‑law “identification doctrine”. A company was criminally liable only if prosecutors could prove the offence was committed by an individual who was the company’s “directing mind and will” — typically a board‑level figure.

In complex, multi‑layered corporates, that made attribution difficult and often led to outcomes perceived as unsatisfactory, particularly where misconduct occurred below board level. ECCTA 2023 was designed to address this gap for economic crime.

What changed on 26 December 2023: the ECCTA “senior manager” test

ECCTA 2023 introduced a statutory route to attribute certain economic crimes to a corporate where the offence is committed by a senior manager acting within the actual or apparent scope of their authority. Its definition of a senior manager”  is someone who plays a significant role in

• making decisions about how the whole or a substantial part of the organisation’s activities are managed or organised or

• actually, managing or organising the whole or a substantial part of those activities.

If a senior manager commits (or encourages/assists) a listed “economic crime” in that capacity, the act and mental state are attributed to the company. This applies to offences committed on or after 26 December 2023. The list of relevant “economic crimes” is set out in the Act and includes, for example, fraud and bribery offences.

What may change next: extending the senior manager test to all crimes

The Government’s Crime and Policing Bill, currently before Parliament, contains provisions to expand the ECCTA attribution rule so that the “senior manager test” applies to all criminal offences, not just those categorised as economic crime.

The Bill’s Explanatory Notes confirm the policy intent to generalise the ECCTA reform across the criminal law. If enacted in its current form, any criminal offence committed by a senior manager within their authority — from health and safety to environmental and data offences — could be attributed to the company without needing to identify the “directing mind and will”.

Businesses should therefore plan on the basis that attribution risk will widen beyond economic crime.

Key implications for companies

• Lower bar for attribution: Prosecutors no longer need to prove that a board‑level “controlling mind” was involved. A broader range of senior managers can now engage corporate liability for economic crimes — with potential extension to all offences once the Bill passes.
• Wider prosecutorial reach across group structures: The definition focuses on the individual’s role and authority over a substantial part of the business, which will often capture regional heads, and functional leaders (such as senior managers in finance, sales, compliance or operations roles).
• Alignment with modern governance realities: The reform is designed for complex management models, including where managers have dual reporting lines or delegated authority common in City corporates, increasing exposure where oversight is fragmented.
• Interaction with other ECCTA measures: The change sits alongside the new “failure to prevent fraud” offence and enhanced information‑sharing and Companies House reforms, signalling a sustained enforcement agenda. Expect closer scrutiny by the Serious Fraud Office (SFO) and Crown Prosecution Service (CPS) of senior‑manager conduct and corporate controls in London‑centric sectors.

Practical steps to minimise risk

• Map your senior managers: Create a defensible register of roles that exercise significant decision‑making or management over substantial parts of the business, including UK subsidiaries of multinational companies. Document the scope of each role’s authority and any limitations. Update job descriptions and delegation frameworks accordingly.
• Tighten delegated authorities: Ensure financial, contractual and operational authorities are current, specific and monitored. Embed dual‑controls and approval thresholds for higher‑risk activities (e.g. such as major vendor onboarding, high‑risk jurisdictions or political‑exposed‑person engagements).
• Refresh misconduct risk assessments: Re‑baseline risks beyond classic fraud/bribery to anticipate the Bill’s potential expansion (e.g.  sanctions, money laundering, environmental, health and safety, data protection). Calibrate controls and management information to those risks.
• Targeted training for senior managers: Provide concise, scenario‑based training to senior managers, emphasising personal conduct standards, escalation duties and how their actions can now directly attribute liability to the company. Keep attendance and comprehension records.
• Strengthen investigations and reporting lines: Update speak‑up/whistleblowing channels, triage protocols and investigation playbooks so issues involving senior managers are escalated quickly to Legal/Compliance and, where appropriate, the Board or Audit Committee.
• Board oversight: Ensure the board receives regular management information on misconduct indicators, control testing results, and outcomes of internal investigations involving senior managers. Consider a periodic “senior manager conduct” review.
• Prepare for regulatory engagement: Align policies and record‑keeping so you can evidence reasonable prevention and supervision steps to prosecutors if issues arise. Coordinate with any sector regulator expectations where relevant.

Summary

The ECCTA senior‑manager test has already shifted the ground for corporate criminal liability as of 26 December 2023. The Crime and Policing Bill would take that shift economy‑wide by applying the same attribution rule to all criminal offences.

Companies should promptly identify who counts as a senior manager, tighten delegations and controls, refresh training and investigations protocols, and ready the board for enhanced oversight.

Early action will put you in the strongest position if the reforms are fully extended